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Remarks 

Claims 2-3, 5, 14-21, 31, and 34 have been amended in 
response to the criticisms in the Official Action and claim 39 
has been canceled. Reconsideration and withdrawal of the 
objection and rejection to the form of the claims are 
respectfully requested. 

Claims 1-6, 8-10, 12, 14-23, 26, 29-31, 33-34, 37, and 39-41 
were rejected as unpatentable over CHEFALAS et al . 2002/0116639 
in view of LIANG et al . 2004/0030913. The independent claims 
have been amended and reconsideration and withdrawal of the 
rejection are respectfully requested. 

The amended claims define a security system and method in 
which a first sub-system detects an unknown malicious software 
having a characteristic unknown to the first sub-system, the 
first sub-system being configured to perform a partial simulation 
to activate unknown malicious software having the characteristic 
unknown to the first sub-system for causing a consequence of the 
activation of the unknown malicious software and thereafter to 
detect the activated unknown malicious software by detecting the 
consequence of the activation of the unknown malicious software. 

CHEFALAS et al . disclose a security system (VSN and/or VSC) 
for repelling malicious software that includes a first sub-system 
that detects known malicious software having a known 
characteristic, where the first sub-system is configured to 
perform a scan for known malicious software to find the known 
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malicious software having the known characteristic, and to detect 
the known malicious software by detecting the known 
characteristic. In CHEFALAS et al . , the virus scanners of the 
VSN or VSC detect a malicious software using malicious software 
databases that include the features of known malicious software. 
Thus, CHEFALAS et al . do not disclose that the first sub-system 
detects an unknown malicious software having a characteristic 
unknown to the first sub-system, where the first sub-system is 
configured to perform a partial simulation to activate unknown 
malicious software having the characteristic unknown to the first 
sub-system for causing a consequence of the activation of the 
unknown malicious software and thereafter to detect the activated 
unknown malicious software by detecting the consequence of the 
activation of the unknown malicious software. 

LIANG et al . disclose a security system for repelling 
malicious software that includes a first sub-system (110) that 
detects an unknown malicious software having a characteristic 
unknown to the first sub-system, where the first sub-system is 
configured to profile the unknown malicious software to detect a 
suspicious characteristic of the unknown malicious software, and 
where the first sub-system detects the unknown malicious software 
by detecting the suspicious characteristic. LIANG et al . does 
not disclose or suggest a partial simulation to activate the 
unknown malicious software. LIANG et al . look for suspicious 
characteristics to detect unknown malicious software. 
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If one of skill in the art were to combine CHEFALAS et al . 
and LIANG et al . , the artisan would see that LIANG et al . suggest 
that the way to detect unknown malicious software is by detecting 
a suspicious characteristic, not by a partial simulation to 
activate the unknown malicious software. The technique suggested 
in CHEFLAS et al . is for known malicious software, not unknown 
malicious software. One of skill in the art would not use the 
technique for known malicious software suggested in CHEFALAS et 
al . to detect unknown malicious software when LIANG et al . 
suggest a different technique. 

That is, the combination is silent regarding using a partial 
simulation to activate an unknown malicious software for causing 
a consequence of the activation that is later detected. 

In view of the present amendment and the foregoing remarks, 
it is believed that the present application has been placed in 
condition for allowance. Reconsideration and allowance are 
respectfully requested. 

The Commissioner is hereby authorized in this, concurrent, 
and future replies, to charge payment or credit any overpayment 
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to Deposit Account No. 25-0120 for any additional fees required 
under 37 C.F.R. § 1.16 or under 37 C.F.R. § 1.17. 

Respectfully submitted, 

YOUNG & THOMPSON 



/Thomas W. Perkins/ 
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209 Madison Street, Suite 500 
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